CVE-2026-26014
MediumAdvisory
Published 11 Feb 2026In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.9
- base score, highest
- EPSS
- 0.006
- 49th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 73
- of 17,781 indexed, latest versions
- Container images
- 59
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
Pion DTLS's usage of random nonce generation with AES GCM ciphers risks leaking the authentication key
Carried by container images the latest versions of 73 of 17,781 indexed charts deploy, on 59 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v2.0.9, v2.0.13, v2.1.0, v2.1.5+6 more | no fix listed | 46 |
| github.com/ | v3.0.4, v3.0.6, v3.0.7, v3.0.9+2 more | 3.0.11, 3.1.1 | 22 |
- OSV records
- GHSA-9f3f-wv7r-qc8r
- Also known as
- GO-2026-4479
Charts affected
73 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| xatu-relay-monitorethereum-helm-chartsVerified publisher | 0.0.1 | 1 of 1See more | 579 |
| xatu-sageethereum-helm-chartsVerified publisher | 0.0.1 | 1 of 1See more | 579 |
| xatu-sentryethereum-helm-chartsVerified publisher | 0.0.8 | 1 of 1See more | 579 |
| xatu-serverethereum-helm-chartsVerified publisher | 0.0.14 | 1 of 1See more | 579 |
| beekeeperethersphereVerified publisher | 0.4.14 | 1 of 1See more | 1,604 |
| rtsp-to-webgeek-cookbookVerified publisher | 2.2.2 | 1 of 1See more | 1,467 |
| torrservergeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 3,165 |
| erigoninfradao | 0.0.5 | 1 of 2See more | 2,868 |
| tor-proxykubernetes-homelab-helm-chartsVerified publisher | 0.1.2 | 1 of 1See more | 1,480 |
| ingresslivekit-server | 1.2.2 | 1 of 1See more | 10,716 |
| livekit-serverlivekit-server | 1.9.0 | 1 of 1See more | 1,552 |
| home-assistantlmatfyVerified publisher | 0.1.38 | 1 of 1See more | 2,444 |
| telegraf-dslsst-sqre | 1.0.23 | 1 of 1See more | 3,764 |
| firehose-ethereumnodeifyVerified publisher | 1.7.1 | 1 of 2See more | 5,565 |
| one-green-coreone-green-coreVerified publisher | 0.0.7 | 1 of 8See more | 9,558 |
| home-assistantpascaliskeVerified publisher | 0.1.1 | 1 of 1See more | 4,749 |
| firehose-ethereumpinaxVerified publisher | 0.3.2 | 1 of 2See more | 7,062 |
| unifi-protectschichtelVerified publisher | 0.10.1 | 1 of 1See more | 5,582 |
| erigonstakewise | 2.61.2 | 1 of 3See more | 2,938 |
| ipfsstakewise | 2.2.0 | 1 of 2See more | 1,239 |
| ssv-nodestakewise | 2.2.0 | 1 of 2See more | 6,779 |
| v3-backendstakewise | 3.6.0 | 1 of 5See more | 1,239 |
| proxyv2flyVerified publisher | 0.0.6 | 1 of 1See more | 1,426 |
Container images carrying it
59 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | f9de3a1a5deb | github.com/ | no fix listed | 1 |
| ghcr.io/ | 032e977d9adf | github.com/ github.com/ | no fix listed 3.0.11 | 1 |
| ghcr.io/ | 372d991e5888 | github.com/ | 3.0.11 | 1 |
| ghcr.io/ | 56690a89c79a | github.com/ | 3.0.11 | 1 |
| ghcr.io/ | 9a5a3eb4a213 | github.com/ | 3.0.11 | 1 |
| ghcr.io/ | 067e54e2e107 | github.com/ | 3.0.11 | 1 |
| ghcr.io/ | d7bdfa7b41da | github.com/ | no fix listed | 1 |
| ghcr.io/ | 8e3cb38953a3 | github.com/ | no fix listed | 1 |
| ghcr.io/ | e5ecfd607e42 | github.com/ | no fix listed | 1 |